How do you enable SBOM generation in GAS?

• A. Install a separate SBOM tool and run it after scanning.
• B. Enable SBOM output in the Code Scanning workflow.
• C. Enable SBOM generation by installing a separate SBOM tool.
• D. Enable SBOM output in the Code Scanning workflow or in GAS settings; ensure the SBOM is generated and stored with scan results.

Answer: (D)

SBOM generation in GAS is controlled by turning on the SBOM output, either in the Code Scanning workflow or in GAS settings, and making sure the SBOM is generated and stored with the scan results. This built-in option ensures the SBOM is produced as part of the scan and attached to the results, so you can access it alongside the findings. Installing a separate SBOM tool after scanning isn’t required and adds extra steps without automatically integrating with GAS scan results. The most straightforward approach is to enable the built-in SBOM output in the Code Scanning workflow or GAS settings so the SBOM is created during the scan and saved with the results.